fix: build script venv handling and lint fixes

- Use /opt/venv directly when --entrypoint bash bypasses entrypoint.sh
- Use sys.executable for all pip calls (not bare pip)
- Override entrypoint in CI workflow to avoid startup banner
- Fix Biome formatting (template literals, try/catch blocks)

.github/workflows/ai-bundles.yml

@@ -102,11 +102,11 @@ jobs:
           VERSION: ${{ inputs.version }}
         run: |
           mkdir -p /tmp/bundles
-          docker run --rm \
+          docker run --rm --entrypoint bash \
             -v "$PWD/docker/build-bundle.sh:/build-bundle.sh:ro" \
             -v "/tmp/bundles:/output" \
             "ghcr.io/snapotter-hq/snapotter:${VERSION}" \
-            bash /build-bundle.sh "${BUNDLE}" "${ARCH}" /output
+            /build-bundle.sh "${BUNDLE}" "${ARCH}" /output
 
       - name: Upload artifact
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2